Subject: [Last-Call] SECDIR review of draft-ietf-dnsop-rfc7816bis-09

From: Donald Eastlake <[email-masked]>
Date: Thu, 3 Jun 2021 16:18:59 -0400

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. Document editors and WG chairs should treat these comments just
like any other last call comments.

The summary of the review is READY.

This is an excellent draft about how to minimize the information sent
to higher level DNS servers (those serving zones closer to root) to
protect privacy. There are more subtleties and 2nd order potential
difficulties with this than I would have expected but, as far as I can
tell, these are all covered by the draft, as one might expect in a bis
draft that incorporates lessons learned in the deployment of the
original (RFC 7816).

One wonders if/when it might be better to use AAAA as the substitute
QTYPE for minimized queries rather than A  :-)

Below I have a few suggested wording changes which I believe would be
small improvements but I consider optional.

Minor Suggestions:

Section 1, page 3: "this choice at this time" -> "this choice at that time"

Section 1.1, page 3:
"lessons learned from implementing QNAME minimization" ->
"lessons learned from implementing RFC 7816 QNAME minimization"

Section 2.1, page 5: To clarify, for readers who don't know, that RFC
8305 is the happy eyeballs RFC:
OLD
   records.  Another potential benefit of using QTYPE=A is that
   [RFC8305] clients that need answers for both the A and AAAA types
NEW
   records.  Another potential benefit of using QTYPE=A is that
   happy eyeballs [RFC8305] clients that need answers for both the A
and AAAA types

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [email-masked]

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 3 Jun 2021 16:37:59 -0400

> On 3 Jun 2021, at 4:18 pm, Donald Eastlake <[email-masked]> wrote:
> 

We're not there yet.  There is still a non-trivial number of domains
where A lookups succeed, but AAAA lookups SERVFAIL.

-- 
	Viktor.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 7 Jun 2021 10:53:42 +0200

On Thu, Jun 03, 2021 at 04:18:59PM -0400,
 Donald Eastlake <[email-masked]> wrote 
 a message of 45 lines which said:

> IESG.

There is apparently some glitch on the datatracker since your review
is marked as not done yet
<https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7816bis/reviewrequest/14679/>.

> QTYPE for minimized queries rather than A  :-)

There are two reasons to use A (probably the biggest changed since RFC
7816):

- minimize the risk of failure with broken middleboxes choking on
QTYPE they don't know,
- since the whole goal is privacy, you're more lost in the crowd with
A requests.

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 7 Jun 2021 07:59:54 -0400

Dear Stephane and Viktor,

There is a reason I put a smiley face after my comment about AAAA. I
think the use of A is adequately motivated by text in the draft.

Stephane: I'm not sure why the review was not marked as done but it is
so marked now.

Thanks,
Donald